[BUGFIX] XSS in tcemain flash message
authorGeorg Ringer <mail@ringerge.org>
Wed, 27 Jul 2011 10:29:41 +0000 (12:29 +0200)
committerOliver Hader <oliver@typo3.org>
Wed, 27 Jul 2011 10:30:59 +0000 (12:30 +0200)
Change-Id: Ia5855b7c37fd7940e545a129c0d8d3c628dc903c
Resolves: #24535
Reviewed-on: http://review.typo3.org/3759
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
t3lib/class.t3lib_tcemain.php

index e8fae3a..65eff86 100644 (file)
@@ -7579,7 +7579,7 @@ State was change by %s (username: %s)
                        $msg = $row['error'] . ': ' . sprintf($row['details'], $log_data[0], $log_data[1], $log_data[2], $log_data[3], $log_data[4]);
                        $flashMessage = t3lib_div::makeInstance(
                                                't3lib_FlashMessage',
-                                               $msg,
+                                               htmlspecialchars($msg),
                                                '',
                                                t3lib_FlashMessage::ERROR,
                                                TRUE